Re: [PATCH bpf] bpf, ppc64: fix out of bounds access in tail call

[Alexei Starovoitov]

On Mon, Feb 26, 2018 at 10:00:47PM +0100, Daniel Borkmann wrote:
> While working on 16338a9b3ac3 ("bpf, arm64: fix out of bounds access in
> tail call") I noticed that ppc64 JIT is partially affected as well. While
> the bound checking is correctly performed as unsigned comparison, the
> register with the index value however, is never truncated into 32 bit
> space, so e.g. a index value of 0x1ULL with a map of 1 element
> would pass with PPC_CMPLW() whereas we later on continue with the full
> 64 bit register value. Therefore, as we do in interpreter and other JITs
> truncate the value to 32 bit initially in order to fix access.
> 
> Fixes: ce0761419fae ("powerpc/bpf: Implement support for tail calls")
> Signed-off-by: Daniel Borkmann 
> Reviewed-by: Naveen N. Rao 
> Tested-by: Naveen N. Rao 

Applied to bpf tree, thanks Daniel.

[PATCH bpf] bpf, ppc64: fix out of bounds access in tail call

[Daniel Borkmann]

While working on 16338a9b3ac3 ("bpf, arm64: fix out of bounds access in
tail call") I noticed that ppc64 JIT is partially affected as well. While
the bound checking is correctly performed as unsigned comparison, the
register with the index value however, is never truncated into 32 bit
space, so e.g. a index value of 0x1ULL with a map of 1 element
would pass with PPC_CMPLW() whereas we later on continue with the full
64 bit register value. Therefore, as we do in interpreter and other JITs
truncate the value to 32 bit initially in order to fix access.

Fixes: ce0761419fae ("powerpc/bpf: Implement support for tail calls")
Signed-off-by: Daniel Borkmann 
Reviewed-by: Naveen N. Rao 
Tested-by: Naveen N. Rao 
---
 arch/powerpc/net/bpf_jit_comp64.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/net/bpf_jit_comp64.c 
b/arch/powerpc/net/bpf_jit_comp64.c
index 0a34b0c..0ef3d95 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -240,6 +240,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct 
codegen_context *ctx, u32
 *   goto out;
 */
PPC_LWZ(b2p[TMP_REG_1], b2p_bpf_array, offsetof(struct bpf_array, 
map.max_entries));
+   PPC_RLWINM(b2p_index, b2p_index, 0, 0, 31);
PPC_CMPLW(b2p_index, b2p[TMP_REG_1]);
PPC_BCC(COND_GE, out);
 
-- 
2.9.5